Read the docs
TI-2017-09616 Aliases CVE-2017-12972GHSA-2qp9-wg27-9pcv

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length…

Priority LOW 35CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.

Why it matters now

EPSS 0.00888 59th percentileScored 2026-11-07
Fix Fixed com.nimbusds:nimbus-jose-jwt (Maven): 4.39

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.nimbusds:nimbus-jose-jwt (Maven)before 4.394.39Patch availableGHSA-2qp9-wg27-9pcv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.nimbusds:nimbus-jose-jwt (Maven) Vendor— Affected before 4.39 Fixed in 4.39 Patch available GHSA-2qp9-wg27-9pcv

CPE configurations NVD · 127

CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.0:*:*:*:*:*:*:*1.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.1:*:*:*:*:*:*:*1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.2:*:*:*:*:*:*:*1.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.3:*:*:*:*:*:*:*1.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.4:*:*:*:*:*:*:*1.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.5:*:*:*:*:*:*:*1.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.6:*:*:*:*:*:*:*1.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.7:*:*:*:*:*:*:*1.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.8:*:*:*:*:*:*:*1.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9:*:*:*:*:*:*:*1.9VulnerableConnect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Connect2id
Show 117 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.10:*:*:*:*:*:*:*1.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.11:*:*:*:*:*:*:*1.11VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.12:*:*:*:*:*:*:*1.12VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0:*:*:*:*:*:*:*2.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1:*:*:*:*:*:*:*2.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.2:*:*:*:*:*:*:*2.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.3:*:*:*:*:*:*:*2.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.4:*:*:*:*:*:*:*2.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.5:*:*:*:*:*:*:*2.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.6:*:*:*:*:*:*:*2.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.7:*:*:*:*:*:*:*2.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.8:*:*:*:*:*:*:*2.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.9:*:*:*:*:*:*:*2.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10:*:*:*:*:*:*:*2.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.0:*:*:*:*:*:*:*2.13.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.1:*:*:*:*:*:*:*2.13.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.14:*:*:*:*:*:*:*2.14VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15:*:*:*:*:*:*:*2.15VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.1:*:*:*:*:*:*:*2.15.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.2:*:*:*:*:*:*:*2.15.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.16:*:*:*:*:*:*:*2.16VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17:*:*:*:*:*:*:*2.17VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.1:*:*:*:*:*:*:*2.17.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.2:*:*:*:*:*:*:*2.17.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18:*:*:*:*:*:*:*2.18VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.1:*:*:*:*:*:*:*2.18.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.2:*:*:*:*:*:*:*2.18.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19:*:*:*:*:*:*:*2.19VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19.1:*:*:*:*:*:*:*2.19.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.20:*:*:*:*:*:*:*2.20VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.21:*:*:*:*:*:*:*2.21VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22:*:*:*:*:*:*:*2.22VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22.1:*:*:*:*:*:*:*2.22.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.23:*:*:*:*:*:*:*2.23VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.24:*:*:*:*:*:*:*2.24VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.25:*:*:*:*:*:*:*2.25VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26:*:*:*:*:*:*:*2.26VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26.1:*:*:*:*:*:*:*2.26.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.0:*:*:*:*:*:*:*3.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1:*:*:*:*:*:*:*3.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2:*:*:*:*:*:*:*3.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.3:*:*:*:*:*:*:*3.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.4:*:*:*:*:*:*:*3.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.5:*:*:*:*:*:*:*3.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.6:*:*:*:*:*:*:*3.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.7:*:*:*:*:*:*:*3.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8:*:*:*:*:*:*:*3.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.1:*:*:*:*:*:*:*3.8.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.2:*:*:*:*:*:*:*3.8.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9:*:*:*:*:*:*:*3.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.1:*:*:*:*:*:*:*3.9.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.2:*:*:*:*:*:*:*3.9.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.10:*:*:*:*:*:*:*3.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0:*:*:*:*:*:*:*4.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1:*:*:*:*:*:*:*4.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.2:*:*:*:*:*:*:*4.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3:*:*:*:*:*:*:*4.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.4:*:*:*:*:*:*:*4.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.5:*:*:*:*:*:*:*4.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.6:*:*:*:*:*:*:*4.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.7:*:*:*:*:*:*:*4.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.8:*:*:*:*:*:*:*4.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.9:*:*:*:*:*:*:*4.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.10:*:*:*:*:*:*:*4.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11:*:*:*:*:*:*:*4.11VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.1:*:*:*:*:*:*:*4.11.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.2:*:*:*:*:*:*:*4.11.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.12:*:*:*:*:*:*:*4.12VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13:*:*:*:*:*:*:*4.13VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13.1:*:*:*:*:*:*:*4.13.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.14:*:*:*:*:*:*:*4.14VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15:*:*:*:*:*:*:*4.15VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15.1:*:*:*:*:*:*:*4.15.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16:*:*:*:*:*:*:*4.16VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.1:*:*:*:*:*:*:*4.16.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.2:*:*:*:*:*:*:*4.16.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.17:*:*:*:*:*:*:*4.17VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.18:*:*:*:*:*:*:*4.18VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.19:*:*:*:*:*:*:*4.19VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.20:*:*:*:*:*:*:*4.20VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.21:*:*:*:*:*:*:*4.21VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.22:*:*:*:*:*:*:*4.22VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.23:*:*:*:*:*:*:*4.23VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.24:*:*:*:*:*:*:*4.24VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.25:*:*:*:*:*:*:*4.25VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26:*:*:*:*:*:*:*4.26VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26.1:*:*:*:*:*:*:*4.26.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27:*:*:*:*:*:*:*4.27VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27.1:*:*:*:*:*:*:*4.27.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.28:*:*:*:*:*:*:*4.28VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.29:*:*:*:*:*:*:*4.29VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.30:*:*:*:*:*:*:*4.30VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31:*:*:*:*:*:*:*4.31VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31.1:*:*:*:*:*:*:*4.31.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.32:*:*:*:*:*:*:*4.32VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.33:*:*:*:*:*:*:*4.33VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34:*:*:*:*:*:*:*4.34VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.1:*:*:*:*:*:*:*4.34.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.2:*:*:*:*:*:*:*4.34.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.35:*:*:*:*:*:*:*4.35VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.36.1:*:*:*:*:*:*:*4.36.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37:*:*:*:*:*:*:*4.37VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37.1:*:*:*:*:*:*:*4.37.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.38:*:*:*:*:*:*:*4.38VulnerableConnect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.9:*:*:*:*:*:*:* Versions 2.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10:*:*:*:*:*:*:* Versions 2.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.0:*:*:*:*:*:*:* Versions 2.13.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.1:*:*:*:*:*:*:* Versions 2.13.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.1:*:*:*:*:*:*:* Versions 2.15.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.2:*:*:*:*:*:*:* Versions 2.15.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.16:*:*:*:*:*:*:* Versions 2.16 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17:*:*:*:*:*:*:* Versions 2.17 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.1:*:*:*:*:*:*:* Versions 2.17.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.2:*:*:*:*:*:*:* Versions 2.17.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18:*:*:*:*:*:*:* Versions 2.18 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.1:*:*:*:*:*:*:* Versions 2.18.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.2:*:*:*:*:*:*:* Versions 2.18.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19.1:*:*:*:*:*:*:* Versions 2.19.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22.1:*:*:*:*:*:*:* Versions 2.22.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26.1:*:*:*:*:*:*:* Versions 2.26.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.7:*:*:*:*:*:*:* Versions 3.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.1:*:*:*:*:*:*:* Versions 3.8.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.2:*:*:*:*:*:*:* Versions 3.8.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9:*:*:*:*:*:*:* Versions 3.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.1:*:*:*:*:*:*:* Versions 4.11.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.2:*:*:*:*:*:*:* Versions 4.11.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13:*:*:*:*:*:*:* Versions 4.13 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13.1:*:*:*:*:*:*:* Versions 4.13.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.14:*:*:*:*:*:*:* Versions 4.14 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15:*:*:*:*:*:*:* Versions 4.15 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15.1:*:*:*:*:*:*:* Versions 4.15.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16:*:*:*:*:*:*:* Versions 4.16 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.1:*:*:*:*:*:*:* Versions 4.16.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.2:*:*:*:*:*:*:* Versions 4.16.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.17:*:*:*:*:*:*:* Versions 4.17 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.18:*:*:*:*:*:*:* Versions 4.18 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.19:*:*:*:*:*:*:* Versions 4.19 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.24:*:*:*:*:*:*:* Versions 4.24 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26.1:*:*:*:*:*:*:* Versions 4.26.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27:*:*:*:*:*:*:* Versions 4.27 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27.1:*:*:*:*:*:*:* Versions 4.27.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.28:*:*:*:*:*:*:* Versions 4.28 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.29:*:*:*:*:*:*:* Versions 4.29 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.30:*:*:*:*:*:*:* Versions 4.30 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31.1:*:*:*:*:*:*:* Versions 4.31.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.1:*:*:*:*:*:*:* Versions 4.34.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.2:*:*:*:*:*:*:* Versions 4.34.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.36.1:*:*:*:*:*:*:* Versions 4.36.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37:*:*:*:*:*:*:* Versions 4.37 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37.1:*:*:*:*:*:*:* Versions 4.37.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.38:*:*:*:*:*:*:* Versions 4.38 Vulnerable ·Connect2id

Remediation

  • Fix · GHSA-2qp9-wg27-9pcv com.nimbusds:nimbus-jose-jwt (Maven) Fixed in 4.39 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12972
  2. 2026-10-03 Alias added: GHSA-2qp9-wg27-9pcv

References

Patch 1

Advisory 3

Other 2

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2023-28776 In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service… CVSS 3.1HIGH 7.5
  • TI-2017-09618 Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the… CVSS 3.0HIGH 7.5
  • TI-2017-09617 Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in… CVSS 3.0LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences